Alibaba Cloud AI Audio TTS Voice Design

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 6:29 PM UTC
• Version: 1.0.1

Overview

The skill is a straightforward Alibaba Cloud Qwen TTS voice-design helper with some minor documentation and dependency hygiene issues, but no evidence of hidden persistence, exfiltration, or destructive behavior.

Install and run this in a virtual environment, prefer a pinned reviewed dashscope version, and provide Alibaba Cloud credentials only when you intend to make API calls. The generic region/resource-id workflow text should be read as provider boilerplate rather than a separate request for broad cloud authority.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:24

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 24
Vulnerability Type: Unpinned third-party dependency and mutable supply chain
Risk Level: Medium

Vulnerable code:

bash

python -m pip install dashscope

Technical Analysis

The setup instructions install dashscope without a version constraint, lockfile, or cryptographic hash. Consequently, the package and its transitive dependencies are resolved from the user's configured package index at installation time and may differ from the versions originally reviewed.

Python packages or their build dependencies can execute code during installation, while imported packages execute with the privileges of the invoking process. A compromised package release, compromised transitive dependency, unsafe package index, or dependency-resolution change could therefore introduce unreviewed code.

The included helper script does not import dashscope; it only writes request JSON and validates a local JSON response. The dependency installation is therefore unnecessary for the helper's implemented behavior, although it may be relevant to the broader documented Alibaba Cloud workflow.

Attack Path

1. An attacker compromises a future dashscope release, one of its transitive dependencies, or a package source configured on the user's system.
2. A user follows the Skill prerequisite and runs python -m pip install dashscope.
3. pip resolves the mutable, unpinned dependency graph from the configured index.
4. Malicious code executes during package build or installation, or later when the installed package is imported.
5. The code operates with the permissions and environment access of the user who invoked Python.

This is a conditional supply-chain attack path; the audited project does not itself contain malicious dependency code or prove that the named package is compromised.

Impact Assessment

Successful exploitation could execute arbitrary code w ...[truncated 527 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the SDK installation prerequisite when users only need the included local request-preparation helper.
2. For workflows that genuinely require the SDK, pin a reviewed exact version, for example:

   bash

   python -m pip install "dashscope==<reviewed-version>"
   

3. Maintain a lockfile covering transitive dependencies and update it through a controlled review process.
4. Generate and verify dependency hashes, using pip install --require-hashes -r requirements.txt where practical.
5. Explicitly use a trusted package index and prevent unintended fallback to untrusted or privately controlled indexes.
6. Run installation and API operations in an isolated virtual environment or container under a non-privileged account.
7. Review dependency updates for provenance, security advisories, unexpected build scripts, and transitive dependency changes before adoption.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill instructs users to run local scripts, compile Python files, and write outputs under project directories, but it does not declare any explicit tool scope such as permissions or allowed-tools. This mismatch weakens security boundaries because an agent may infer broader file read/write capability than the skill metadata makes visible, increasing the chance of unintended filesystem access.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 11)May include surrounding context.

md

# Model Studio Qwen TTS Voice Design

Use voice design models to create controllable synthetic voices from natural language descriptions.

## Critical model names

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest and the rest of the document describe a narrowly scoped voice-design workflow with inputs like voice_prompt, text, and optional streaming. The workflow section instead uses generic cloud-operation language about regions, identifiers, and read-only versus mutating actions, which does not match the actual documented capability and suggests copied guidance that contradicts the skill's stated intent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.